{"id":"CVE-2026-35386","title":"In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line","summary":"In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration…","severity":"low","cvss":3.6,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-696","CWE-78"],"vendor":"openbsd","product":"openssh","affected":["openssh >= 10.0, < 10.3"],"patched":["openssh 10.3"],"published":"2026-04-02","updated":"2026-07-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35386","references":[{"url":"https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2","label":"cve@mitre.org"},{"url":"https://www.openssh.org/releasenotes.html#10.3p1","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/04/02/3","label":"cve@mitre.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35386.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-35386"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454506"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35386"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35386"},{"url":"https://access.redhat.com/errata/RHSA-2026:12389"},{"url":"https://access.redhat.com/errata/RHSA-2026:13380"},{"url":"https://access.redhat.com/errata/RHSA-2026:19069"},{"url":"https://access.redhat.com/errata/RHSA-2026:13383"},{"url":"https://access.redhat.com/errata/RHSA-2026:21398"},{"url":"https://access.redhat.com/errata/RHSA-2026:22648"},{"url":"https://access.redhat.com/errata/RHSA-2026:22564"},{"url":"https://access.redhat.com/errata/RHSA-2026:16059"},{"url":"https://access.redhat.com/errata/RHSA-2026:13381"},{"url":"https://access.redhat.com/errata/RHSA-2026:19219"},{"url":"https://access.redhat.com/errata/RHSA-2026:22329"},{"url":"https://access.redhat.com/errata/RHSA-2026:21298"},{"url":"https://access.redhat.com/errata/RHSA-2026:25096"},{"url":"https://access.redhat.com/errata/RHSA-2026:14937"},{"url":"https://access.redhat.com/errata/RHSA-2026:74674"},{"url":"https://access.redhat.com/errata/RHSA-2026:21275"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00319,"epssPercentile":0.24661,"ingestedAt":"2026-07-07T16:15:38.005Z","slug":"CVE-2026-35386","body":"## Overview\n\nIn OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.\n\n## Affected\n\n- `openssh >= 10.0, < 10.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssh 10.3`\n\n## Vendor advisories\n\n- **RHSA-2026:12389** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12389)\n- **RHSA-2026:13380** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13380)\n- **RHSA-2026:19069** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19069)\n- **RHSA-2026:13383** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13383)\n- **RHSA-2026:21398** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6) · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21398)\n- **RHSA-2026:22648** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22648)\n- **RHSA-2026:22564** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22564)\n- **RHSA-2026:16059** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2026-05-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:16059)\n- **RHSA-2026:13381** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13381)\n- **RHSA-2026:19219** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19219)\n- **RHSA-2026:22329** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22329)\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35386.json)","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":19.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}